fix: do not serve file with dirname prefix

Author: lukeed

packages/sirv/index.mjs

@@ -1,5 +1,5 @@
 import * as fs from 'node:fs';
-import { join, normalize, resolve } from 'node:path';
+import { join, normalize, resolve, sep } from 'node:path';
 import { totalist } from 'totalist/sync';
 import { parse } from '@polka/url';
 import { lookup } from 'mrmime';
@@ -39,7 +39,10 @@ function viaLocal(dir, isEtag, uri, extns) {
 	let i=0, arr=toAssume(uri, extns);
 	let abs, stats, name, headers;
 	for (; i < arr.length; i++) {
-		abs = normalize(join(dir, name=arr[i]));
+		abs = normalize(
+			join(dir, name=arr[i])
+		);
+
 		if (abs.startsWith(dir) && fs.existsSync(abs)) {
 			stats = fs.statSync(abs);
 			if (stats.isDirectory()) continue;
@@ -161,7 +164,7 @@ export default function (dir, opts={}) {
 		});
 	}
 
-	let lookup = opts.dev ? viaLocal.bind(0, dir, isEtag) : viaCache.bind(0, FILES);
+	let lookup = opts.dev ? viaLocal.bind(0, dir + sep, isEtag) : viaCache.bind(0, FILES);
 
 	return function (req, res, next) {
 		let extns = [''];

tests/helpers.mjs

@@ -33,7 +33,10 @@ export function http(opts) {
 		send(method, path, opts) {
 			let uri = new URL(path, address);
 			return send(method, uri, opts);
-		}
+		},
+		get address() {
+			return address;
+		},
 	};
 }
 

tests/publicfile.txt

@@ -0,0 +1 @@
+hello

tests/sirv.mjs

@@ -1,4 +1,5 @@
 import { suite } from 'uvu';
+import * as http from 'node:http';
 import * as assert from 'uvu/assert';
 import sirv from '../packages/sirv/index.mjs';
 import * as utils from './helpers.mjs';
@@ -304,6 +305,31 @@ security('should prevent directory traversal attacks :: dev', async () => {
 	}
 });
 
+security('should prevent files starting with directory name :: dev', async () => {
+	let server = utils.http({ dev: true });
+	let address = server.address;
+
+	try {
+		let status = await new Promise((resolve, reject) => {
+			let req = http.request({
+				hostname: address.hostname,
+				port: +address.port,
+				path: '/../publicfile.txt',
+				method: 'HEAD',
+			}, (res) => {
+				resolve(res.statusCode);
+			});
+
+			req.on('error', reject);
+			req.end();
+		});
+
+		assert.is(status, 404);
+	} finally {
+		server.close();
+	}
+});
+
 security.run();
 
 // ---